Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. This race condition can be triggered when multiple processes access a shared resource without proper locking, leading to the execution of privileged code or operations. The primary impact is that a user with local access can gain higher privileges, potentially compromising system integrity and allowing further malicious actions. Key weakness is CWE-362.

The vulnerability affects various Microsoft Windows builds, including Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 22H3; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, including server core installations. All listed builds are impacted per the advisory.

The CVSS base score is 7 (Medium), indicating significant potential impact. The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: an authorized user must be able to run processes that trigger the race condition. Exploitation requires no special network access or elevated privilege beforehand, but requires local presence. Due to the nature of the race condition, reliable exploitation may be complex, but once achieved it results in privilege escalation.